CVE-2018-16949

CVE-2018-16949 is a denial-of-service vulnerability affecting OpenAFS versions prior to 1.6.23 and 1.8.x prior to 1.8.2. The flaw stems from unbounded array types used for RPC input variables, allowing an unauthenticated attacker to send excessively large inputs. This can consume significant server resources, leading to a denial of service for legitimate users. With a CVSS score of 7.5 (HIGH), this vulnerability is easily exploitable over the network with low attack complexity, resulting in high availability impact. There is currently no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion surrounding this CVE.